On 22 Nov 2017, at 10:11 (-0500), Info @ brainwash wrote:
/var/spool/MIMEDefang/ directory has rights 0766 and belongs to user
defang:defang (it is been reset to these values every time the
mimedefang
service restarts or the server reboots).
Dianne has already given the proper solution but this begs for a general
warning...
Setting the world-writable bit on any file or on a directory without
also setting the sticky bit is a risky action. You should NEVER leave a
file or directory world-writable. Also on directories, it is generally
not useful to set read bits without also setting the execute (i.e.
search, for directories) bits.
From what I found when Googling this error, the issue is that
MIMEDefang cannot create the work directory thus Clam cannot find the
file to scan.
It's usually best to read the man pages that are written by the author
of a program before searching for random answers on the web who may not
understand their problem, may not be getting an error message for the
same reason you are, and may be using a version (or platform variant)
that is unlike yours. This looks to me like a wrong answer but it really
does not matter because the fix is simple and clearly documented in the
mimedefang man page.
I tried to make the directory 0777 and even change the users using
chown, to no effect.
Reiterating the above: don't set the world-writable bit anywhere except
on shared directories with the sticky bit set (e.g. /tmp and /var/tmp
use mode 1777) and (sometimes) sockets and devices. It's not a safe
solution to any problem and usually isn't even helpful as a
troubleshooting tool.
MIMEDefang by design creates and destroys many files and directories for
short lives, so for safety it needs to manage permissions itself very
carefully and tightly. It cannot rely on sysadmins creating safe working
ownership and permission constructs because it is a known fact that many
sysadmins never actually read documentation. It is conceivable that MD
could have been written to be entirely ignorant of security issues and
rely on sysadmins to use whatever mix of standard ownership &
permissions, BSD setgid semantics, and ACLs is available and necessary
to allow everything MD does to work safely. I believe that if that were
the case, MD would have a reputation of being hard to make work and
grossly insecure. It's better this way.
--
Bill Cole
[email protected] or [email protected]
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Currently Seeking Steady Work: https://linkedin.com/in/billcole
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.
Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list [email protected]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
